<html>


<meta http-equiv="Content-Type" content="text/html;charset=UTF-8">
<head>

<meta name="GENERATOR" content="Microsoft FrontPage 6.0">
<link href="Attributes_files/topic000.css" rel="stylesheet" type="text/css">
<title>Attributes</title>
</head>

<body>

<h1>Attributes</h1>

<p>Any attribute consists of a header and a body. Attribute header and the body of a resident attribute are stored in file record within MFT (please see the File Records section). The body of a non-resident attribute is stored outside MFT in one or several clusters indicated in a special list in the header of that attribute (please see the <a href="http://www.pc-3000flash.com/eng/help/help_information/ntfs/data_runs.htm">Data Runs</a> section). If the 8-bit field at offset 08h bytes from the beginning of an attribute header is equal to 0, then the attribute is considered to be resident; if it is 1 – then it is non-resident. No other values are allowed.</p>

<p>Four initial bytes of an attribute header determine its type. An attribute's type, in its turn, defines the presentation format for the attribute's body. </p>

<p><strong>Table 1</strong>. Types of attributes</p>

<p><img src="Attributes_files/attribut.gif"></p>

<p>The next four bytes contain attribute length expressed in bytes. The length of a non-resident attribute is equal to a sum of its body and header; and the length of a resident attribute equals the length of its header. Thus, if we add an attribute's length to its offset, we can receive a pointer to the next attribute (or end marker if the current attribute is the last one in a chain).</p>

<h6><img src="Attributes_files/attribuu.gif"></h6>

<h6>Identification of attribute location in a file record </h6>

<p>The body length of resident attributes expressed in bytes is stored in a 32-bit field located at offset 10h bytes after the start of an attribute header. The 16-bit field following it is used to store the offset of the resident body counted from the beginning of an attribute header. </p>

<p>In non-resident attributes lots of fields are used for storage of the length of their bodies. Real size of attribute expressed in bytes is stored in the 64-bit field located at offset 30h bytes from the beginning of an attribute header. It is followed by a 64-bit field that preserves initialized data size of the stream expressed in bytes and, judging by all signs, always equal to the real size of attribute body. Another 64-bit field located at offset 28h bytes from the start of an attribute header is used to store the allocated size of attribute expressed in bytes and equal to the real attribute size rounded (up) to cluster size.</p>

<p>Two 64-bit fields located at offsets 10h and 18h bytes from the start of an attribute header define the first (starting VCN) and the last (last VCN) virtual cluster number belonging to the body of that non-resident attribute. Virtual clusters are logical cluster numbers independent from their physical location on disk. In most cases, the number of the first cluster of a non-resident attribute body is equal to zero and the last one – to the number of clusters occupied by the attribute body minus one. The 16-bit field at offset 20h from the start of an attribute header contains a pointer to the Data&nbsp;Runs array within that header, which describes the logical order of placement on disk for a non-resident attribute body (please see the <a href="http://www.pc-3000flash.com/eng/help/help_information/ntfs/data_runs.htm">Data Runs</a> section for details).</p>

<p>Every attribute has its own identifier (attribute ID) unique for that file record and preserved in a 16-bit field located at offset 0Eh from the start of an attribute header.</p>

<p>If an attribute has an attribute Name property, then the 16-bit field at offset 0Ah bytes from the attribute header will contain a pointer to it. For nameless attributes it is zero (most attributes have no names). Attribute name is stored in an attribute header in UNICODE format; its length is defined by a 8-bit field located at offset 09h bytes from an attribute start.</p>

<p>If an attribute body is compressed, encrypted or sparse, the 16-bit flag field at offset 0Ch bytes from the start of an attribute header will not be equal to zero.</p>

<p><strong>Table 2.</strong> Resident attribute structure</p>

<p><img src="Attributes_files/attribuv.gif"></p>

<p><strong>Table 3.</strong> Non-resident attribute structure</p>

<p><img src="Attributes_files/attribuw.gif"></p>

<p>&nbsp;</p>

<p><a href="http://www.pc-3000flash.com/eng/help/help_information/ntfs/attribute/standard_information.htm">Standard information attribute ($STANDARD_INFORMATION, 10h)</a></p>

<p><a href="http://www.pc-3000flash.com/eng/help/help_information/ntfs/attribute/attribute_list.htm">List of attributes ($ATTRIBUTE_LIST, 20h)</a></p>

<p><a href="http://www.pc-3000flash.com/eng/help/help_information/ntfs/attribute/file_name.htm">File name attribute ($FILE_NAME, 30h)</a><br> <br> <br>
</p>
</body>
</html>

<!-- This document saved from http://www.pc-3000flash.com/eng/help/help_information/ntfs/attribute.htm -->
